Getting Started
Changelog
What shipped on the MUDBASE API, grouped by day. Internal-only changes (dependency bumps, CI, refactors) aren't listed here.
Stablecoin payment collection paused
- Stablecoin payment collection (the enable, create-deposit-address, balances, off-ramp, and on-ramp endpoints, and the console pages built on them) is paused for every org: each of these now returns 503 instead of completing. No organization currently has this enabled, so this is a no-op against real usage.
- The pause is because the underlying processor issues one shared wallet address per currency/network for the whole platform account rather than a distinct address per organization, so an incoming deposit cannot be attributed to the right org. It stays paused until a per-organization deposit address is available.
Payout onboarding now supports every country the backend already prices
- The Connect Payments onboarding form in the console now renders its country list, field set, and validation directly from GET /api/orgs/:orgId/payment-processing/countries instead of a hardcoded Nigeria/Ghana/Kenya list, so every payout country the backend already supports and prices is selectable.
- Each country's fields (bank code vs. mobile-money network, a live bank dropdown vs. a free-text code, whether a BVN is required, routing number/sort code plus an account holder name for the US and UK) come from the same response, so the form never needs a per-country special case.
- Submitting the form still only validates and stores payout details; it queues the org for a platform-admin review and does not enable live payouts by itself. Poll GET /api/orgs/:orgId/payment-processing/status for approvalStatus rather than assuming payments are live the moment this call returns.
Breaking: push notifications now deliver only to registered device tokens
- Push notifications now deliver only to device tokens registered to the project. Any token in a push request that has not been registered to that project is dropped before delivery, so the send endpoint can no longer be used to target arbitrary or other-tenant device tokens.
- Register a device token before you push to it. New endpoints (all under the messaging resource permission, authenticated with a bearer token or API key): POST /api/messaging/projects/{projectId}/messaging/devices to register a token (body: token, plus an optional platform of ios, android, or web); GET /api/messaging/projects/{projectId}/messaging/devices to list the tokens registered to a project; and DELETE /api/messaging/projects/{projectId}/messaging/devices to unregister a token on logout or token rotation (body: token).
- Migration - register on token acquisition, then push: when your app obtains a device push token, first POST it to /messaging/devices, then send to it via /messaging/push exactly as before. Registration is idempotent (re-registering the same token just refreshes it), so it is safe to call on every app launch.
- If none of the tokens in a push request are registered to the project, the send is rejected with a 400 and the message "None of the provided device tokens are registered to this project. Register a device token before sending a push notification.", along with the list of rejected tokens. Tokens that are registered are unaffected.
Sign in and start building before verifying your email
- New accounts can now sign in and make their first API call right away - email verification is no longer required before you start building.
- Until you verify, your account runs on a reduced starter tier: 1 project, 2 API keys per project, 1,000 API calls per month, 100 MB of storage, and a tighter request rate limit.
- A few trust-sensitive actions stay locked until you verify: changing or upgrading your plan, raising limits, billing and credit top-ups, inviting teammates, configuring payouts, and sending outbound email. These return a 403 with the code EMAIL_VERIFICATION_REQUIRED_FOR_ACTION so your app can prompt the user to verify and offer to resend the link.
- Verify your email once to lift the starter caps and unlock every gated action. Accounts created before this change are unaffected and keep their existing limits.
Add-ons pricing, faster dashboard, credit alerts
- Add-ons marketplace now shows real per-call pricing in the public catalog.
- Dashboard overview loads faster - queries run in parallel and are cached.
- Fixed a gap that let raw transaction broadcasts skip identity verification.
- Credit balance: added a low-balance alert with a user-configurable threshold.
Add-ons marketplace, KYC, stablecoin payments, and more
- Functions now execute reliably in production (previously blocked by a networking bug).
- Added GDPR data export and erasure endpoints.
- Outbound webhooks now fire for collection, email, KYC, Functions, billing, and backup events.
- Added the Add-ons marketplace: metered paid extras (QR codes, PDF generation, CSV export, hashing, GeoIP lookups, and more).
- Added a token-authenticated MCP server for paid accounts.
- Added stablecoin payments (USDC/USDT) with HMAC-verified webhooks.
- Added identity verification (KYC/KYB) - gates billing setup and can be resold white-label to your own users.
- Added an in-app service credit balance, drawn down automatically on plan overage.
- Fixed several billing and usage undercounts - Collections and Functions writes weren't being metered.
- API keys can now read and write collection data directly (previously blocked in some paths).
Block-based wallet monitoring
- Added block-based wallet monitoring for ETH and UTXO chains, plus a scanner metrics API.
Billing, subscriptions, and payment plans
- Added billing, subscriptions, and payment plans for projects.
Sub-organizations
- Organizations can now have sub-organizations.
50+ integrations and Chat
- Added 50+ third-party API integrations and a Chat feature.
API key authentication
- Added API key authentication.